Extracted

Extracted

• • Target

    bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9.exe

  • Size

    891KB

  • MD5

    1179dd8e427142d60d82f588fcdb2138

  • SHA1

    03cb870e3ba8994943709b0f6c15bde9ebe20d04

  • SHA256

    bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9

  • SHA512

    cc4cb1d1291fce22a637722c47a92f78e5bba894fe6cd3429189bc3807b4d8bd52b55c104ce51f07b8995663167555b08e037bdb3b6ceb17ab0b58ecb9e765fc

  • SSDEEP

    12288:DUx1l4E2P1dzsCBW/T9smPym20WJ5oxswsJ42//1NjoIHN:gt4E2P1dzsCqRXWLox5sXnfkk

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1